Fix source-backed project reference matching

[dfederm]

Summary

Fixes #149, where RT0002 falsely reported used same-language project references as removable because Roslyn exposes them as source-backed CompilationReference instances rather than file-backed references. Matching now uses full assembly identity for source-backed references and file paths for PE-backed references.

The declared-reference manifest adds an optional project fusion-name column while remaining compatible with existing three-column rows. RT0001 and RT0003 retain their existing path-based behavior.

Why this is safe

• Preserves backward compatibility with legacy three-column manifests.
• Uses full assembly identities only for source-backed project references; PE references retain path-based matching.
• Includes identity-affecting project-reference metadata in incremental hash inputs.
• Handles transitive and duplicate project identities conservatively.
• Limits the change to RT0002 and its supporting task and manifest plumbing.

Validation

Test / build	Result
GitHub Actions ubuntu-latest	Passed
GitHub Actions windows-latest	Passed
Current intent review	Aligned
Current code review	Clean, 0 findings

Closes #149